aimap

AIMap Erkennungs- und Sicherheitstest-Plattform im Internet-Maßstab für exponierte KI-Agenten-Infrastruktur. AIMap findet, identifiziert und testet öffentlich exponierte KI-Endpunkte auf Sicherheit – MCP-Server, Ollama-Instanzen, vLLM/LiteLLM-Proxys, LangServe-Ketten, Gradio-Apps, ComfyUI-Knoten...

vulnerable-mcp-servers-lab

Laboratorio di server MCP vulnerabili Questo repository contiene implementazioni volutamente vulnerabili di server Model Context Protocol MCP sia locali che remoti. Ogni server risiede nella propria cartella e include un README.md dedicato con tutti i dettagli su cosa fa , come eseguirlo e come...

agent-opfor

Emulazione dell'avversario open-source per agenti AI, app LLM e server MCP. Testa la tua IA come farebbe un vero attaccante — dal tuo CLI, dal tuo IDE o da un'estensione del browser che chiunque nel tuo team può usare. Sito web · Documentazione · GitHub · ·...

agent-scan

Snyk Agent Scan Scopri e analizza i componenti degli agent sulla tua macchina per individuare injection di prompt e vulnerabilità incluse agent, server MCP e skill. Nota: l'output della CLI è sperimentale e soggetto a modifiche Agent Scan v0.5.x previsto per la rimozione L'output grezzo di questa...

CVE

CVE-Tabelle CVE-Nummer| Typ| Unternehmen/Produkt| Beschreibung| Artikel-Link| Repository-Link ---|---|---|---|---|--- CVE-2026-9680| SQLi| Alibaba RDS MCP Servers| TBA| TBA| TBA CVE-2026-50335| LPE| Windows Juli 2026| TBA| TBA| TBA GHSA-73cv-556c-w3g6| SQLi| Apache Pinot MCP 3.1.0| Fehlende...

LLM-MCP-Security-Field-Guide

🛡️ KI-Sicherheitsleitfaden — LLM + MCP-Sicherheit Der umfassendste, aktuellste, praxisorientierte Sicherheitsleitfaden für LLM-Anwendungen und Model Context Protocol MCP-Bereitstellungen. Behandelt echte CVEs, Live-Angriffsmuster, OWASP-Frameworks, Red-Teaming-Tools und handlungsorientierte...

mcp-xray

MCP X-Ray Übersicht MCP X-Ray ist eine einheitliche Open-Source-Sicherheitsscan- und Penetrationstestlösung für Model Context Protocol MCP-Server. Es erzeugt produktionsreife SARIF-Berichte für die nahtlose Integration in Sicherheitstools und CI/CD-Pipelines. Suchergebnisse können optional auf...

rbinmcp

rbinmcp - Eingestellt Dieses Repository wurde eingestellt und in separate, wartbare MCP-Server aufgeteilt: r2 Backend - github.com/kirkderp/rbinr2 Ghidra Backend - github.com/kirkderp/rbinghidra ILSpy .NET Backend - github.com/kirkderp/rbinilspy Der gesamte Code und alle Crates wurden entfernt, u...

pkgxray

pkgxray — pre-install security for npm packages, MCP servers, and AI agents Inspect an npm package or MCP server before you install or connect to it, and get a deterministic, evidence-backed SAFE, REVIEW, or BLOCK verdict. Local, zero-dependency static analysis — normal scans never execute packag...

mcp-server-attestation

Parte delloStudioMeyer MCP Stack — Costruito a Maiorca 🌴 · ⭐ se lo usi mcp-server-attestation Rafforzamento della supply chain di Layer-2 per i server Model Context Protocol. Manifest degli strumenti firmati con Ed25519, attestazione runtime degli spawn, sanitizer degli argomenti con negazione...

CVE-2026-71424

CVE-2026-71424 is a critical cross-user OAuth token leak in Onyx , an open-source AI platform. The GET /api/mcp/servers and GET /api/mcp/servers/persona/{persona_id} endpoints expose another user's OAuth Authorization header. The root cause is that OnyxTokenStorage.set_tokens and OnyxTokenStorage...

CVE-2026-71424 Onyx: Cross-user OAuth-token leak via /api/mcp/servers* for per-user MCP servers

Onyx is an open-source AI platform. Prior to 3.1.10, 3.2.14, and 4.0.0, Onyx's GET /api/mcp/servers and GET /api/mcp/servers/persona/personaid endpoints expose another user's OAuth Authorization header because OnyxTokenStorage.settokens and OnyxTokenStorage.setclientinfo in...

CVE-2026-19770

A vulnerability was identified in feedmob fm-mcp-servers 0.0.3. Affected by this vulnerability is the function downloadReport of the file src/smadex-reporting/src/index.ts of the component Download Endpoint. The manipulation of the argument downloadUrl leads to server-side request forgery. The...

CVE-2026-19770

The CVE-2026-19770 entry affects feedmob fm-mcp-servers 0.0.3, specifically the Download Endpoint’s Download Report function (src/smadex-reporting/src/index.ts). The vulnerability arises from manipulation of the downloadUrl argument, enabling server-side request forgery (SSRF). Exploitation is de...

CVE-2026-19770 feedmob fm-mcp-servers Download Endpoint index.ts downloadReport server-side request forgery

A vulnerability was identified in feedmob fm-mcp-servers 0.0.3. Affected by this vulnerability is the function downloadReport of the file src/smadex-reporting/src/index.ts of the component Download Endpoint. The manipulation of the argument downloadUrl leads to server-side request forgery. The...

EUVD-2026-58563

A vulnerability was identified in feedmob fm-mcp-servers 0.0.3. Affected by this vulnerability is the function downloadReport of the file src/smadex-reporting/src/index.ts of the component Download Endpoint. The manipulation of the argument downloadUrl leads to server-side request forgery. The...

CVE-2026-19770

A vulnerability was identified in feedmob fm-mcp-servers 0.0.3. Affected by this vulnerability is the function downloadReport of the file src/smadex-reporting/src/index.ts of the component Download Endpoint. The manipulation of the argument downloadUrl leads to server-side request forgery. The...

CVE-2026-19244

A vulnerability was detected in HKUDS nanobot up to 0.2.1. The affected element is the function connectmcpservers of the file nanobot/agent/tools/mcp.py of the component MCP enabledTools Scope Handler. Performing a manipulation results in improper access controls. The attack is possible to be...

CVE-2026-19244 HKUDS nanobot MCP enabledTools Scope mcp.py connect_mcp_servers access control

A vulnerability was detected in HKUDS nanobot up to 0.2.1. The affected element is the function connectmcpservers of the file nanobot/agent/tools/mcp.py of the component MCP enabledTools Scope Handler. Performing a manipulation results in improper access controls. The attack is possible to be...

CVE-2026-19244

The CVE affects HKUDS nanobot